fix: Preserve Trusted Jq Path for PTC

[danny-avila]

I fixed native programmatic execution so the trusted jq executable discovered during preflight remains available to generated PTC scripts inside the sandbox. This closes #204.

• Return both validated Bash and jq paths from native programmatic preflight.
• Forward the trusted jq path through the executor IPC contract and inject it only into programmatic command environments.
• Invoke jq through LIBRECHAT_CODE_JQ_PATH in generated Bash replay infrastructure, with a jq fallback for runtimes that do not provide the native variable.
• Add regression coverage for a sanitized PATH that omits the discovered jq directory and for eliminating bare jq calls from generated preambles.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• Ran npm run build in packages/code.
• Ran node --test dist/native-process.test.js dist/native-sandbox.test.js (74 passed).
• Ran bun test src/preamble-bash.test.ts in service (17 passed).
• Ran bunx tsc --noEmit --pretty false in service; it reports five pre-existing unrelated errors in egress-gateway.test.ts, egress-gateway.ts, egress-grant.ts, sandbox-backend/index.test.ts, and service/replay-state.ts.

Test Configuration:

• macOS
• Node.js 24.16.0
• Bun 1.3.13

Checklist

• My code adheres to this projects style guidelines
• I have performed a self-review of my own code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[danny-avila]

@codex review

Please review the current PR head 0073c05. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T19:43:05.494125Z	0073c05	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 0073c05151

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".